On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
References
Link | Resource |
---|---|
https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md | Exploit Third Party Advisory |
https://www.verizon.com/info/reportsecurityvulnerability/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
History
08 Aug 2023, 14:21
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-798 |
21 Jul 2022, 02:02
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-522 | |
References | (MISC) https://www.verizon.com/info/reportsecurityvulnerability/ - Vendor Advisory | |
References | (MISC) https://github.com/JousterL/SecWriteups/blob/main/Verizon%20LVSKIHP%205G%20Modem/readme.md - Exploit, Third Party Advisory | |
CPE | cpe:2.3:h:verizon:lvskihp_outdoorunit:-:*:*:*:*:*:*:* cpe:2.3:o:verizon:lvskihp_indoorunit_firmware:3.4.66.162:*:*:*:*:*:*:* cpe:2.3:h:verizon:lvskihp_indoorunit:-:*:*:*:*:*:*:* cpe:2.3:o:verizon:lvskihp_outdoorunit_firmware:3.33.101.0:*:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
14 Jul 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-07-14 13:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-28371
Mitre link : CVE-2022-28371
CVE.ORG link : CVE-2022-28371
JSON object : View
Products Affected
verizon
- lvskihp_outdoorunit
- lvskihp_indoorunit
- lvskihp_indoorunit_firmware
- lvskihp_outdoorunit_firmware
CWE
CWE-798
Use of Hard-coded Credentials